feat(auth): complete registration anti-spam and quota hardening

app/Services/Auth/DisposableEmailService.php

@@ -0,0 +1,66 @@
+<?php
+
+namespace App\Services\Auth;
+
+class DisposableEmailService
+{
+    public function isEnabled(): bool
+    {
+        return (bool) config('registration.disposable_domains_enabled', true);
+    }
+
+    public function isDisposableEmail(string $email): bool
+    {
+        if (! $this->isEnabled()) {
+            return false;
+        }
+
+        $domain = $this->extractDomain($email);
+        if ($domain === null) {
+            return false;
+        }
+
+        $blocked = (array) config('disposable_email_domains.domains', []);
+        foreach ($blocked as $entry) {
+            $pattern = strtolower(trim((string) $entry));
+            if ($pattern === '') {
+                continue;
+            }
+
+            if ($this->matchesPattern($domain, $pattern)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    private function extractDomain(string $email): ?string
+    {
+        $normalized = strtolower(trim($email));
+        if ($normalized === '' || ! str_contains($normalized, '@')) {
+            return null;
+        }
+
+        $parts = explode('@', $normalized);
+        $domain = trim((string) end($parts));
+
+        return $domain !== '' ? $domain : null;
+    }
+
+    private function matchesPattern(string $domain, string $pattern): bool
+    {
+        if ($pattern === $domain) {
+            return true;
+        }
+
+        if (! str_contains($pattern, '*')) {
+            return false;
+        }
+
+        $quoted = preg_quote($pattern, '#');
+        $regex = '#^' . str_replace('\\*', '.*', $quoted) . '$#i';
+
+        return (bool) preg_match($regex, $domain);
+    }
+}